[Bug]: Packaged desktop backend fails to start with Cannot find module 'zod/v4' after @cursor/sdk 1.0.38 #25840

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

Build, CI, or release tooling

Steps to reproduce

1. Build the desktop app from main at or after 850d1e7 (fix(provider-cursor): bump @cursor/sdk to 1.0.38 so long-context tiers send Max Mode #21074, @cursor/sdk 1.0.35 → 1.0.38), e.g. d033768ec7.
2. Launch the packaged app.

Expected behavior

The bundled backend starts.

Actual behavior

The backend child exits immediately with Cannot find module 'zod/v4', required from app.asar/node_modules/@cursor/sdk/dist/cjs/index.js. The desktop app retries and then gives up, so there is no server.

@cursor/sdk 1.0.38 moved zod from dependencies to peerDependencies ("zod": "^3.25.0 || ^4.0.0"). zod is a runtime external of the server bundle (CURSOR_RUNTIME_DEPENDENCIES in scripts/lib/cli-external-packages.ts), but the desktop stage only receives the externals that apps/server/package.json lists (selectCliRuntimeExternalDependencies(serverDependencies)), and apps/server does not list zod. Before 1.0.38, zod reached the stage as a regular dependency of @cursor/sdk; now nothing staged depends on it, and app.asar ships @cursor/sdk without it.

No release is affected yet: v0.1.3 and the latest nightly (d2c440312e5f) predate #21074. The next nightly built from main will be the first to carry it.

Impact

Blocks work completely

Version or commit

main @ d033768

Environment

macOS 26 (Apple Silicon), desktop nightly. Observed on a fork build that merged upstream main at 6bbb2d8508; the fork's changes to scripts/build-desktop-artifact.ts are limited to dev signing and a locale, and the dependency staging is identical to upstream. Linux and Windows builds were not checked, nor was the npx t3 CLI archive, which uses the same external selection but no electron-builder.

Logs or stack traces

Error: Cannot find module 'zod/v4'
Require stack:
- /Applications/T3 Code (Nightly).app/Contents/Resources/app.asar/node_modules/@cursor/sdk/dist/cjs/index.js
- /Applications/T3 Code (Nightly).app/Contents/Resources/app.asar/apps/server/dist/binCli-tX336eyv.mjs
    at Module._resolveFilename (node:internal/modules/cjs/loader:1571:15)
    ...
    at zod/v4 (/Applications/T3 Code (Nightly).app/Contents/Resources/app.asar/node_modules/@cursor/sdk/dist/cjs/index.js:1:267549)
  code: 'MODULE_NOT_FOUND'

Node.js v24.22.0

Workaround

Add "zod": "^4.6.5" to apps/server/package.json dependencies (the version already in the lockfile). With that, app.asar contains node_modules/zod beside @cursor/sdk and the backend starts. A PR with this change and a regression test follows.